Visa Inc. · NYSE:V
Visa — Technical Presentation (December 2014)
22 slides from Visa's technical presentation, Dec 10, 2014
Slide 1: “BlackPOS” Malware Deconstructed Webinar
“BlackPOS” Malware Deconstructed Webinar 10 December 2014 Visa Public
Slide 2: Disclaimer
Disclaimer The information or recommendations contained herein are provided "AS IS" and intended for informational purposes only and should not be relied upon for operational, marketing, legal, technical, tax, financial or other advice. When implementing any new strategy or practice, you should cons
Slide 3: Agenda
Agenda • The Discovery of BlackPOS • Malware Capabilities • Attack Characteristics • BlackPOS Detection Strategies • POS Malware Prevention • Questions and Answers 3 | “BlackPOS” Malware Deconstructed | 10 December 2014 Visa Public
Slide 4: The Discovery of “BlackPOS”
The Discovery of “BlackPOS” 4 | “BlackPOS” Malware Deconstructed | 10 December 2014 Visa Public
Slide 5: Background and Discovery
BlackPOS Background and Discovery • Initially seen “in the wild” in early 2012 • Dubbed Kaptoxa, pronounced (“Kar-toe-sha”) based on strings found in the malware • Identified again in late 2013, believed to be found at several retailers • Linkages found to earlier POS malware • Source code has been
Slide 6: Research and Analysis
BlackPOS Research and Analysis • Security researchers are continually reverse-engineering • String found in one of the earlier versions: z:\Projects\Rescator\MmonNew\Debug\mmon.pdb • Since its discovery, many different versions have been identified –each with new or slightly different characteristic
Slide 7: Malware Capabilities
BlackPOS Malware Capabilities 7 | “BlackPOS” Malware Deconstructed | 10 December 2014 Visa Public
Slide 8: Point-of-Sale (POS) RAM Scraping
Point-of-Sale (POS) RAM Scraping Merchant Network Cardholder POS Hardware POS Software Visa Issuing Acquiring Bank Bank 8 | “BlackPOS” Malware Deconstructed | 10 December 2014 Visa Public
Slide 9: POS RAM Scraping Primer
POS RAM Scraping Primer • Authorization data temporarily stored in clear text system memory • Cybercriminals attack memory space because it is the easiest path to the data • RAM scrapers generally use logic to identify track 1 and 2 data • Some malware known to use Luhn algorithm to validate • Captu
Slide 10: (somewhat) Unique Characteristics
BlackPOS (somewhat) Unique Characteristics Recent Variations and Functionality • Additional functionality: • Self-deletion capability post exfiltration (reported in recent versions) • Not service dependent, so removal is more likely • Character shifting obfuscation • System level log scrubbing, e.g.
Slide 11: Capabilities
BlackPOS Capabilities Core Capabilities With Varying “bells and whistles” • Different variations each incident (no MD5 match, no A/V detection) • Installation and persistence mechanisms • Memory-scraping • Data encoding and masking • Data exfiltration • Self-removal 11 | “BlackPOS” Malware Deconstru
Slide 12: Attack Characteristics
Attack Characteristics 12 | “BlackPOS” Malware Deconstructed | 10 December 2014 Visa Public
Slide 13: Attack Characteristics
BlackPOS Attack Characteristics Initial Attack Vectors • Common attack scenarios • Remote access credentials • Internet-facing systems with weak authentication • Botnet infection • Exfiltration occurs via ports / services commonly associated with data transfer • ICMP • TLS/HTTPS • NetBIOS • SSH • FT
Slide 14: Post-Attack Infrastructure Setup
Post-Attack Infrastructure Setup Once Inside: Network Exploration and Exploit Tools Accompanying BlackPOS • Network exploration and system mapping • Proxies • Privileged account identification • Account takeover • Data aggregation • Data exfiltration • Evidence cleanup / anti-forensics 14 | “BlackPO
Slide 15: Characteristics
BlackPOS Characteristics POS Malware Distribution, Data Aggregation, Hiding and Exfiltration • BlackPOS malware installation • Data movement timing mechanism • Aggregation servers • “Jump” servers for data exfiltration 15 | “BlackPOS” Malware Deconstructed | 10 December 2014 Visa Public
Slide 16: Detection Strategies
BlackPOS Detection Strategies 16 | “BlackPOS” Malware Deconstructed | 10 December 2014 Visa Public
Slide 17: Prevention and Detection Strategies
BlackPOS Prevention and Detection Strategies Prevention Early Warning Signs IOCs Multi-layered Defense Be vigilant and prepared. Fraudsters target the weakest link and can evolve quickly 17 | “BlackPOS” Malware Deconstructed | 10 December 2014 Visa Public
Slide 18: Warning Signs
BlackPOS Warning Signs • Unexpected applications in memory on POS systems • Unexplained SMB traffic from or from the POS system (possibly encrypted) • New, unexplained (likely encrypted or encoded) files on the POS • Newly installed Windows services on POS systems • Outbound FTP traffic to the Inter
Slide 19: Prevention
BlackPOS Prevention • Ensure that overall payment processing environment is securely configured and maintained in accordance with the PCI DSS. • Ensure that firewall rules only allow remote access from known IP addresses • If remote connectivity is required, enable it only when needed • Contact your
Slide 20: Indicators of Compromise (IOCs)
Indicators of Compromise (IOCs) • Operating system target selection • Windows XP, mostly Professional • Processes activity • Searches for pos.exe to determine what to scrape • Exfiltration • Creates file output.txt which may contain card data • Creates .dll files (e.g., twain_32*.dll) which may cont
Slide 21: Upcoming Events and Resources
Upcoming Events and Resources Upcoming Webinars – Training tab on www.visa.com/cisp • Layering Secure Technologies to Strengthen Payment Card Environments ‒ 21 January 2015, 10 am PST Visa Data Security Website – www.visa.com/cisp • Alerts, Bulletins • Best Practices, White Papers • Webinars PCI Sec
Slide 22: Questions?
Questions? Visa Public